VM-21—Security Testing Window

>Control Description

Security administrators notify relevant parties prior to executing technical security assessments; assessment details and results are documented in a ticket.

Theme

Process

Type

Preventive

Policy/Standard

Vulnerability Management Policy

>Implementation Guidance

1. Ensure a process has been defined and documented to notify relevant parties before executing technical security assessments. 2. Ensure all assessment details and results are appropriately documented.

>Testing Procedure

1. Inspect and validate whether a process has been defined and documented to notify relevant parties before executing technical security assessments. 2. Validate for a sample assessment whether details and results were appropriately documented. 3. Also validate whether appropriate notification was sent to all relevant parties prior to executing the assessment.